System and Method for Controlling Braking Functions in an Autonomous Vehicle

This application is a continuation of co-pending U.S. patent application Ser. No. 16/667,830, entitled SYSTEM AND METHOD FOR CONTROLLING BRAKING FUNCTIONS IN AN AUTONOMOUS VEHICLE, filed Oct. 29, 2019, which is a continuation of co-pending U.S. patent application Ser. No. 16/667,830, entitled SYSTEM AND METHOD FOR CONTROLLING BRAKING FUNCTIONS IN AN AUTONOMOUS VEHICLE, filed Oct. 29, 2019, now U.S. Pat. No. 11,858,491, issued Jan. 2, 2024, which claims the benefit of co-pending U.S. Provisional Application Ser. No. 62/752,687, entitled SYSTEM AND METHOD FOR CONTROLLING BRAKING FUNCTIONS IN AN AUTONOMOUS VEHICLE, filed Oct. 30, 2019, the teachings of each of which applications are expressly incorporated herein by reference.

This invention relates to autonomous vehicles, and more particularly to braking and backup control systems for such vehicles.

Trucks are an essential part of modern commerce. These trucks transport materials and finished goods across the continent within their large interior spaces. Such goods are loaded and unloaded at various facilities that can include manufacturers, ports, distributors, retailers, and end users. Large over-the road (OTR) trucks typically consist of a tractor or cab unit and a separate detachable trailer that is interconnected removably to the cab via a hitching system that consists of a so-called fifth wheel and a kingpin. More particularly, the trailer contains a kingpin along its bottom front and the cab contains a fifth wheel, consisting a pad and a receiving slot for the kingpin. When connected, the kingpin rides in the slot of the fifth wheel in a manner that allows axial pivoting of the trailer with respect to the cab as it traverses curves on the road. The cab provides power (through (e.g.) a generator, pneumatic pressure source, etc.) used to operate both itself and the attached trailer.

A wide range of solutions have been proposed over the years to automate one or more processes of a truck, thereby reducing or eliminating the input labor needed by a driver. In one application, trucks that are used to shunt trailers around a yard between storage/parking locations and loading/unloading docks. Such vehicles are generally termed “yard trucks” and can be powered by fossil fuels or electricity in various configurations. Various novel autonomous vehicle implementations and function associated with autonomous vehicle yard trucks (herein termed “AV yard trucks”), are described in commonly assigned U.S. patent application Ser. No. 16/282,258, entitled SYSTEMS AND METHODS FOR AUTOMATED OPERATION AND HANDLING OF AUTONOMOUS TRUCKS AND TRAILERS HAULED THEREBY, filed Feb. 21, 2019, and related applications thereto, the teachings of which are expressly incorporated herein by reference by way of useful background information.

Autonomous, typically unmanned, trucks (AV yard and/or OTR) require computer control over the pneumatic brake system to control speed under nominal conditions and to stop the truck under abnormal or emergency situations. Without this control capability, the autonomous vehicle would not be safely operable. Dual mode autonomous vehicles (vehicles which can be operated manually by an onboard operator or autonomously without an occupant), furthermore, require that the computer control be disengaged during manual operation to minimize the chance of accidental activation of the braking system. This failover capability between automated and human operation may pose challenges in continuous control and operation of a vehicle, as priority must be given to the human operator, while not compromising the future operation of automated systems.

This invention overcomes disadvantages of the prior art by providing an Electronic Brake Controller (EBC) system that addresses the challenges of allowing for failover operation in which a human driver must intervene with autonomous operation, whereby the autonomous braking system is disengaged to ensure safe operation, and avoid accidental deployment of brakes in contravention to the human driver's commands. In an exemplary implementation, the system and method operates to accept braking commands over a communications bus from a control computer and/or via discrete digital inputs from a safety-rated PLC. The system and method also enables control of pneumatic valves to apply pressure to the (e.g.) OEM pneumatic brakes based on those commands. It also allows computer control to be disengaged when configured for manual operation, and monitors control of the pneumatic brakes, computer control lockouts, and internal logic components. The system and method further allows for application of full (emergency stop) braking efforts when anomalies occur and/or power is lost to the system, ensure vehicle safety.

In an illustrative embodiment a system and method for allowing failover between an autonomously controlled braking system and a human controlled braking system in a truck having pneumatic brake lines is provided. A cab-mounted brake actuator is arranged to be handled by the human operator, and is arranged to selectively deliver pressurized air to truck brakes and a trailer brake air supply. A controller performs autonomous braking operations in response to control inputs, and senses when a human operator is handling the actuator. A plurality of valves are provided in a pressure circuit, interconnected between a pressurized air source on the truck, the actuator, the truck brakes and the trailer brake air supply, are responsive to the controller, and are arranged to override selective delivery of pressurized air to the truck brakes of the truck and the trailer brake air supply in response to the autonomous braking operations in favor of selective delivery of pressurized air via the actuator. Illustratively, the actuator is at least one of a brake foot pedal assembly and a parking brake handle assembly. The controller can be arranged to apply emergency stop braking settings to the valves in response to predetermined conditions. The controller includes a vehicle CAN bus that communicates with other vehicle systems. The valves can be adapted to selectively deliver pressurized air to each of service brakes and parking brakes, and/or the valves include a plurality of pressure sensing monitor switches, poppet valves that selectively release pressurized air to an external environment and shuttle valves that override pressure flow from each of a plurality of inputs. The pressure circuit can also include a tank monitor, which is adapted to determine whether tank pressure falls below a predetermined threshold, and in response thereto, the valves apply at least one of the service brakes and the parking brakes and direct the controller to ignore predetermined sensors and switches within the pressure circuit. The controller inputs and outputs signals using at least two substantially redundant physical and communication protocol channels.

1 FIG. 1 FIG.A 100 100 110 112 114 122 124 126 128 130 132 134 140 142 144 146 100 148 Reference is made to, which shows a typical autonomous vehicle truck (e.g. an electrically powered AV yard truck). The truckincludes a cabthat is adapted for human control in addition to autonomous operation, and thus, includes a windshieldand access door, as well as a seat, steering wheel, gear shift, dashboard instrumentation/gauges, and floor pedals for accelerator and braking(). The truck includes steerable front wheelsand (typically) drive rear wheels. A fifth wheel trailer hitchis provided on the rear of the chassis, and can be conventional in design (with appropriate automated control). Other features of the truck, such as the pneumatic connections (e.g. glad hands) and/or power connectionscan be adapted for autonomous/unattended operation when hitching and unhitching the trailer. A vision system camera assemblyis also provided and can be adapted to assist in autonomous guidance. Likewise, other systems (e.g. rear cameras, LIDAR and other range sensors) can be provided to assist autonomous operation (not shown). These systems are managed by one or more hardware and software controllers instantiated on the truck, and/or within a remote server system, linked to the truck by (e.g. wireless) a network link. The above-incorporated U.S. Provisional Application Ser. No. 62/715,757, entitled SYSTEMS AND METHODS FOR AUTOMATED OPERATION AND HANDLING OF AUTONOMOUS TRUCKS

100 170 1 FIG. AND TRAILERS HAULED THEREBY, describes a wide variety of systems and processes that are desirable to allow for the monitoring and operation of autonomous functionality within the depicted truckof. These systems can include an on-board vehicle control unit (VCU)that manages overall operation of the vehicle, including autonomous operations, based upon applicable hardware and/or software processes.

100 150 132 134 144 One of the control units located (in this example) on the truckis an Electronic Brake Controller (EBC). In general, unmanned autonomous vehicles must be stoppable, even if the system experiences component failures or even power loss. Therefore, the EBC operates to provide redundant and failover/failsafe mechanisms to apply full pneumatic braking power the vehicle wheels,, and via the pneumatic connections(or other interfaces) to an attached/hitched trailer (not shown).

1 FIG. 150 152 152 154 158 160 156 162 As shown in, The EBCis interconnected via an electrical connection to appropriate actuators and pressure sensors within a central service brake and parking brake control valve assembly, which includes various fluid-pressure-actuated pneumatic and/or hydraulic elements. The valve assemblyis, likewise, interconnected by appropriate pressure conduits/lines to various operational elements within the overall truck braking system. One connection is to the human operator foot pedal brake treadle valve. A second connection passes through the chassis to the front wheel brake cylinders (on each side)and rear wheel brake cylinders. Various known load-balancing, anti-lock and other control circuitry can also be provided and are omitted for clarity. A third connection is to the manual parking brake valve, which interfaces with a human-operated parking brake control handle. The EBC also interfaces electronically with a safety control interlock circuitlocated at an appropriate position on the vehicle.

156 154 150 By way of background, OEM pneumatic brakes are applied by a human operator in two ways. First, parking or emergency brakes are applied by reducing air pressure from one side of the brake chamber to less than 60 psi. This is accomplished by releasing a plunger valve () inside the vehicle cab. Alternatively, if tank pressure drops below 60 psi, the parking brakes are applied as a default. Additionally, service brakes are applied by supplying air pressure to the other side of the brake chamber. This is accomplished by depressing the brake treadle valve () to supply air from the tank to the brake chamber. The amount of braking power applied is proportional to the pressure supplied from the treadle valve. Full braking power is applied when the full tank pressure is supplied typically, at least approximately 100 psi). The EBC, according to an exemplary embodiment, achieves redundancy by utilizing both of these application methods. Electro-pneumatic valves are used to supply tank pressure to the service brake circuit and apply full service brakes. Electro-pneumatic valves are also used evacuate air from the parking brake circuit, which also applies full braking effort. The electro-pneumatic valves are arranged such that when de-energized, full braking efforts are applied. This approach provides failsafe operation. In summary, regardless of why power is lost to the valves (e.g. vehicle power loss, wire breakage, intentional removal, etc.), the brakes will be applied. During nominal operation, the tank pressure supplied to the service brakes is regulated by a proportional electro-pneumatic valve similar to how the pedal-operated treadle valve operates.

152 150 A significant aspect of the system and method is its ability to operate in dual modes. It provides computer control for autonomous operation while concurrently enabling manual control when properly configured. Electro-pneumatic valves within the valve assemblyare adapted to isolate airflow when operating under manual control. The isolation prevents air pressure from being supplied on the service circuit and evacuated from the parking circuit. If a failure occurs, however, control reverts to the EBC, and full brakes are applied by de-energizing all valves.

154 152 152 Another significant feature of the system and method herein is its ability to permit manual application of service brakes at all times, even when the system is nominally under computer control. This ensures that a human user can exercise override under any circumstance. Shuttle valves are used to implement a max function between the pedal treadle valveand the electro-pneumatic proportional valve, which typically resides in the valve assembly. Whichever valve is applying the most pressure, and therefore braking effort, is honored by the valve assemblyand EBC. This enables the system to be safely used in conjunction with a safety driver when operating autonomously because the safety driver can ultimately apply brakes at any time.

150 When operating under computer control, the Brake Controller ECU (EBC) can accept inputs from both a communications bus (e.g. controller area network (CAN), serial, Ethernet, etc.) and discrete inputs. The communications bus is used under nominal operations to apply and release parking brakes and proportionally apply service brakes. The discrete input signals are provided as a redundant path to apply full braking efforts (for example, during an emergency stop), and to request or inhibit computer control.

150 The operation of all electro-pneumatic valves is monitored using pressure activated switches and transducers by the Brake Controller ECU (EBC). If a valve does not operate as expected, that failure will be detected by the monitoring switch or transducer. The ECU logic will then de-energize all valves to apply full brakes.

2 FIG. 200 150 210 212 214 Reference is made to, which is a simplified block diagram showing an arrangementof inputs and outputs transmitted between modules of the EBC. It is noted that throughout the description there is shown two redundant channels of control and communication A and B. Thus, it can be assumed that any description of one channel applies similarly to the second channel herein and such channels A and B are also referred to collectively. The brake controller logicis responsible for enabling computer control of pneumatic brake systems via a J1939 CAN bus. It provides proportional control of the service brake proportional valve, similar to how a standard treadle valve works, and on/off control of the parking brakes. It controls brake mechanisms for both the tractor and an attached trailer (via pneumatic line (e.g. glad hand connections).

210 It is contemplated that the brake controllercan support an ISO 13849 PLd safety case. To mitigate hazards, ISO 13849 requires that specific safety functions are defined. Those safety functions must include all inputs, logic, outputs, and power that are involved in any potentially hazardous operation. The safety functions defined for the Brake Controller are (a) Emergency Stop Braking and (b) Unintended Control Detection.

150 The Emergency Stop Braking safety function applies full braking efforts using both service brakes and parking brakes under specific internal conditions and external inputs. The Unintended Control Detection safety function determines if the EBCdoes not hand over brake controls to the operator when commanded and causes Emergency Stop Braking.

210 220 222 200 230 230 210 232 230 234 230 236 230 238 The brake controlleralso interconnects to the parking brake on/off valve, trailer supply on/off valve, and any feedback pressure switches via the bus architecture. The arrangementalso includes a safety interlock module circuitaccording to the system and method. As described further below, this moduleoutputs to the brake controller“Computer Control Request” signalsthat manage whether autonomous control is enabled. The modulealso outputs “Emergency (E)-Stop Release” signalsthat cause an emergency stop event to occur. The modulealso outputs “Computer Inhibit OK” signalsthat determine when manual control is enabled. Also, the moduleoutputs “Brake OK” signalsthat determine when normal manual or autonomous brake function can occur.

210 210 224 154 In operation, the brake controllerapplies full braking effort upon power loss, regardless of prior operating mode. In alternate embodiments, it is contemplated that the power loss behavior can vary based on operating mode. The brake controller(based on feedback from (e.g.) switches) performs all self-checking functions associated with braking. That includes verifying that the brake pressures respond appropriately during an e-stop event and ensuring that brake pressures do not change to release brakes if there is a failure in the e-stop chain within the module. That latching behavior can be maintained across power cycles. Notably, the brake controller overrides the in-cab parking brake plunger (treadle valve) functions when operating under computer control.

210 232 234 236 238 230 212 In operation, the brake controllerreads the discrete input signals,,andfrom the safety interlock moduleto determine its intended operating mode. Based on operating mode, it can accept brake commands via the J1939 CAN bus. It also performs various self-checking functions and indicate any critical failures to the safety interlock module.

232 234 236 238 230 300 3 FIG. The above signals,,andof the interlock moduleare expressed as a set of interrelated logical states in the diagramof. These states relate to a particular mode of operation.

210 310 320 330 210 230 The brake controller modulecan operate in one of three modes: Manual Control, Computer Control, and Emergency Stop. These modes are selected based on inputs to the logic blockby the safety interlock module.

310 210 In Manual Control mode, the brake controller modulereleases all control of the service brakes, parking brakes, and trailer supply to ensure that the operator has complete control of the system without interference. This is monitored by the Unintended Control Detection safety function described above.

320 210 214 220 222 320 In Computer Control mode, the brake controller moduleapplies braking efforts based on J1939 CAN bus messages. Controlled braking efforts include actuation of valves for service brake pressure, parking brake application, and trailer air supply, according to commands received on the J1939 CAN bus. If the trailer air is supplied, simply controlling the vehicle/truck service brake pressure and parking brake application serves to control trailer service brakes and trailer parking brakes as these circuits are tied together in a known configuration. In alternate implementations it is contemplated that independent trailer service brake control can be provided. Note that in Computer Control mode, the operator's foot pedal can still apply service brakes, but the in-cab plungers for parking brake and trailer air supply are not operational. This behavior could potentially produce a new hazard if the service brake pedal does not operate correctly for the operator because the operator will not be able to activate the parking brakes. In that case, the operator can still activate the HV disconnect to power-off the truck and apply parking brakes.

330 210 214 220 In Emergency Stop mode, the brake controller modulewill apply full braking efforts using both the service and parking brakes/valves,. This is accomplished by the Emergency Stop Braking safety function described above.

300 310 320 330 3 FIG. With more particular reference to the state diagramof, the operating mode is selected based on discrete inputs and J1939 CAN commands. The following is a more-detailed description of the various modes,and.

310 232 Manual Control Modeis entered when all of the following conditions 340 are met; namely (a) both of the Computer Control Request lines/signalsare electrically disconnected (no current), and (b) J1939 CAN commands are not being received at a rate of at least 20 Hz for more than 100 ms. The mode transition depends upon J1939 CAN commands because in alternate implementations, it can be desirable to remove the Computer Control Request lines and fully apply the J1939 standard paradigm of providing control when messages are present and releasing control when messages are absent.

310 236 When the brake controller module transitions into Manual Control Mode, the service brakes are released, and the parking brakes and trailer supply are no longer being controlled. The parking brakes and trailer supply revert the state commanded by the in-cab plungers. Note that this can result in immediate application of the parking brakes and/or trailer brakes. This can be mitigated by permitting the overall vehicle control unit (VCU) and/or Safety Interlock Module not request computer control until the in-cab plungers are in an appropriate state. Then, the Computer Inhibit OK signalsare asserted to indicate that the module is no longer under computer control.

320 232 320 236 210 The Computer Control Modeis entered when either of the following conditions 342 are met; namely (a) either Computer Control Request signalis active or (b) J1939 CAN commands are being received at a rate of at least 20 Hz. Upon entering Computer Control Mode, the Computer Inhibit OK signalsare de-asserted to indicate the mode change. The brake controller modulethen applies service brakes, parking brakes, and trailer supply air as directed by the J1939 CAN commands.

330 234 330 234 232 210 238 238 210 330 330 The Emergency Stop Modeis entered under any of the following conditions 350; namely (a) power loss, (b) either of the E-Stop Release lines/signalsis disconnected/de-asserted, (c) a critical internal module error is detected). The critical errors that trigger the Emergency Stop modeare, at a minimum, one or more of the following; (a) a disagreement between the A and B inputs of the E-Stop Release signal (), (b) a disagreement between the A and B inputs of the Computer Control Request inputs () and/or J1939 commands, and/or (c) a feedback indicating failure to apply any braking mechanism. When one of these critical errors is encountered, the brake controller moduledisconnects/de-asserts the redundant Brake OK signals. Otherwise, those signalsremain connected to indicate nominal operations. If the brake controller moduleis in the Emergency Stop modedue to a critical error, it will not exit the Emergency Stop mode until the system has been power cycled and the error cleared. If an error is not cleared, the vehicle/truck can still be recovered by manually caging the brakes. This action serves to release the brakes regardless of air pressure, and thus, additional steps are employed to ensure that the truck is not operated while brakes are caged. As shown, once the module is in the Emergency Stop mode, the service brakes and parking brakes are fully applied.

210 230 In alternate implementation it is contemplated that differing default brake behavior can occur during power loss and critical internal error based on operating mode. In such alternate implementations power loss and/or critical internal errors may be arranged to trigger an Emergency Stop only if the module is configured to do so. The below-listed Table 1 defines various operational and safety requirements that are met met by the brake controller module, interlock moduleand related modes.

TABLE 1 Requirement The Brake Controller Module shall be designed to support an ISO 13849 PLd safety case The Brake Controller Module shall provide a Manual Control mode where the module does not apply braking efforts The Brake Controller Module shall provide a Computer Control mode where the module applies braking efforts per J1939 CAN messages The Brake Controller Module shall provide an Emergency Stop mode where full braking efforts are applied The Brake Controller Module shall control the tractor service brake pressure based on J1939 CAN messages in the Computer Control mode The Brake Controller Module shall control the tractor parking brake application based on J1939 CAN messages in the Computer Control mode The Brake Controller Module shall control the trailer service brake pressure based on J1939 CAN messages in the Computer Control mode The Brake Controller Module shall control the trailer parking brake application based on J1939 CAN messages in the Computer Control mode The Brake Controller Module shall receive redundant discrete Computer Control Request input signals that when active indicate that the Computer Control mode is requested The Brake Controller Module shall enter Computer Control mode when either of the Computer Control Request signals are present The Brake Controller Module shall exit Computer Control mode and enter Manual Control mode when both Computer Control Request signals are removed and the J1939 CAN commands are not present for more than 100 ms The Brake Controller Module shall enter the Emergency Stop mode upon power loss The Brake Controller Module shall enter the Emergency Stop mode when either of two redundant Emergency Stop Release signals are disconnected The Brake Controller Module shall enter the Emergency Stop mode upon detection of critical internal errors The Brake Controller Module shall prevent exiting the Emergency Stop mode upon detection of critical internal errors The Brake Controller Module shall allow manual application of the service brakes via the brake pedal regardless of operational mode The Brake Controller Module shall output redundant Brake OK signals to indicate that the module is operating nominally The Brake Controller Module shall disconnect the Brake OK signals to indicate that the module is not operating nominally The Brake Controller Module shall control tractor and trailer service brake pressure to achieve a commanded acceleration based on J1939 CAN messages in the Computer Control mode The Brake Controller Module shall output redundant Computer Inhibit OK signals to indicate that the module is operating in the Manual Control Mode The Brake Controller Module shall enter Computer Control mode when J1939 CAN messages are received at a rate of at least 20 Hz

154 214 154 152 158 160 The Service Brake Control function enables proportional control of the OEM vehicle brakes over a J1939 CAN communications channel. This is accomplished using a proportional pneumatic valve that regulates pressure to the service brakes, similar to the behavior of the treadle valve. The air pressure from the proportional valveand the brake treadle valveis routed through a shuttle valve (e.g. residing in the assembly. The result is that the maximum brake pressure applied between the two sources is applied to the brake cylinders,via the shuttle valve. Details of how the service brake behaves in each operating mode are provided in Table 2 directly below.

TABLE 2 Operating Mode Service Brake Behavior Manual Control Proportional valve is set to 0 pressure to release brakes. Treadle valve will always have equal or greater pressure, ensuring complete control for driver. Computer Proportional valve is set to pressure based on J1939 CAN commands. Control If treadle valve supplies greater pressure, it will control brakes. This ensures a safety operator can always apply more braking power if desired. Emergency Stop Proportional valve is set to maximum pressure to apply full brakes.

152 156 320 The Parking Brake Control function enables engage/disengage control of the OEM parking brakes over a J1939 CAN communications channel. This is accomplished using (e.g.) poppet valves within the assemblythat either supply or evacuate air pressure to the parking brake supply line, similar to the behavior of the hand-operated in-cab plunger valve(s). To apply parking brakes, the poppet valves evacuate pressure from the parking brake supply lines. To release parking brakes, the poppet valves supply tank/reservoir pressure to the parking brake supply lines. Note that if the reservoir pressure is not high enough to release the parking brakes, the Parking Brake Control function cannot fully release the brakes. The control valves are installed such that the in-cab plunger valve does not affect operation of this function when in the Computer Control mode. This alleviates the need for an operator to enter the truck/vehicle and manually release the parking brakes every time autonomous operation is desired, or the reservoir pressure is depleted. Details of how the parking brake behaves in each operating mode are provided in Table 3 directly below.

TABLE 3 Operating Mode Parking Brake Behavior Manual Control Poppet valves route supply air from the in-cab plunger to the parking brake supply line, allowing the in-cab plunger to control parking brake state. Computer Poppet valves route air from reservoir to parking brake supply line to Control release brakes or evacuate air from parking brake supply line to apply brakes depending on J1939 CAN command. Emergency Stop Poppet valves evacuate air from parking brake supply line to apply brakes.

152 156 156 320 The Trailer Brake Supply Control function enables or disables the air supply to a trailer based on J1939 CAN communications commands. This is accomplished using poppet valves within the assemblythat either supply air pressure to, or evacuate air pressure from, the trailer emergency supply line, similar to the behavior of the hand-operated in-cab plunger valve. If the poppet valves supply air to the emergency supply line, then the trailer parking brakes are released, and the trailer service brakes are controlled from the Service Brake Control function, described above. If the poppet valves evacuate the emergency supply line, then the trailer parking brakes are applied, and the service brake pressure is no longer routed to the trailer brake. The poppet valves are installed such that the in-cab plunger valvedoes not affect operation of this function when in the Computer Control mode. This, again, alleviates the need for an operator to access the cab, and manually supply trailer air if/when the reservoir pressure is depleted. Details of how the parking brake behaves in each operating mode are provided in Table 4 directly below.

TABLE 4 Operating Mode Trailer Brake Supply Behavior Manual Control Poppet valves route supply air from the in-cab plunger to the trailer emergency supply line, allowing the in-cab plunger to control trailer supply state. Computer Poppet valves route air from reservoir to trailer emergency supply line to Control release trailer parking brakes and enable control of the trailer service brakes, or they will evacuate air from emergency supply line to apply trailer parking brakes depending on J1939 CAN command. Emergency Stop Poppet valves evacuate air from trailer emergency supply line to apply brakes.

330 400 410 412 410 420 412 422 430 432 410 412 4 FIG. The Emergency Stop Braking safety function is responsible for executing the Emergency Stop Mode. The safety function brings the vehicle to a complete stop by applying full brake efforts under certain exceptional circumstances regardless of operating mode. The Emergency Stop Braking safety function is implemented in accordance with the arrangementshown in. The redundant logic chain, A and B,andare responsible for taking separate discrete actions to apply full braking efforts. The A chainapplies full service brakes (), while the B chainapplies parking brakes. Respective, feedback, in the form of a Brake OK Aand Brake OK B signalmonitors for system failure. If either chain,fails, the other will still stop the truck. Furthermore, if one chain (A or B) fails, the brakes are not released.

400 The Emergency Stop Braking safety function logicchains each receive a single-ended release signal to transition to the Emergency Stop mode. When the release signal is removed, the brake controller module transitions to the Emergency Stop mode. This constitutes a triggering mechanism for the function.

Each safety function chain (A or B) is responsible for outputting independent signals to apply full braking efforts. Additionally, each chain outputs a Brake OK status signal to indicate that the chain is operating nominally. The A chain output applies full service brakes by setting the proportional control valve to maximum pressure. The B chain output applies parking brakes by evacuating the parking brake supply lines. Either chain can bring the vehicle to a complete stop without (free of) the other chain. As the overall system speed/velocity is increased, simply applying full braking efforts may not be the safest execution path. Thus, it is contemplated that more intelligent braking controls can be implemented in alternate embodiments. Some features that can be included are (a) ramped application of service brakes, (b) exclusively applying parking brakes if service brake ramping is not operating correctly or the vehicle is below a threshold speed, and/or (c) implementing anti-lock brake system (ABS) functionality in a manner that can be known to those of skill.

(iii) Error Monitoring

410 412 430 432 4 FIG. Both the A chain logic blockand B chain logic blockperform error checking via feedback (blocksandin). If an error is detected in one chain, then that chain of the safety function enters an error state. In the error state, full braking efforts are applied, and the associated Brake OK signals are removed. Each chain monitors the other for error status. If one chain detects that the other is in error, the detecting chain also removes its output signals to apply full braking efforts.

410 412 450 Each logic chain,A and B performs short-circuit checking on the input E-Stop Release signals. Shorts are checked against ground, power, and between signals. The function will enter the error state when a short circuit is detected. Additionally, the logic blocks compare their respective E-Stop Release signal states against each other via a logic cross-check function. If there is a discrepancy in those states for more than 50 ms, the safety function enters the error state.

410 412 Each logic chain,(A and B) performs short-circuit detection on the output signals. Shorts are checked against ground, power, and between output signals using techniques clear to those of skill. If a short is detected, the offending chain will enter the error state.

Each logic chain (A and B) monitors the effects of its output on brake application. Chain A monitors service brake pressure to verify that the brakes are fully applied. Chain B monitors parking brake pressure to ensure that the parking brakes are applied. If either chain detects that its output is not having the desired effect, it will enter the error state.

5 FIG. 500 310 310 Reference is made to, which shows and arrangementfor the Unintended Control Detection safety function, which is responsible for ensuring that the brake actuation is inactive in the Manual Control mode. The safety function releases brake application and locks out service brake control when configured in the Manual Control mode. If control is not handed back to the operator, then the safety function triggers an internal error, which results in Emergency Stop Braking.

510 512 520 522 510 530 512 532 The redundant logic chainsandare responsible for taking separate discrete actions to prevent/block computer control (,) of the brake function. The A chainreleases the service brakes and parking brakes. The B chainprevents/blocks further brake actuation. If either chain (A or B) fails, then the other chain will not release its brake control. If one chain fails, that chain will enter an error state, and Emergency Stop Braking is triggered. This status is then reflected in the Computer Inhibit OK outputs.

510 520 320 210 310 510 512 210 310 The Unintended Control Detection safety function logic chains,(A and B) each receive a single-ended request signal to request Computer Control mode. These signals are asserted/active-high, so that when the signals are removed, the brake controller modulecan transition to the Manual Control mode. Additionally, each logic chain,monitors incoming J1939 CAN commands. If brake commands are not being received at 20 Hz for more than 100 ms, and the request signals are removed, then the brake control modulewill transition to the Manual Control mode.

510 512 510 512 520 522 310 510 530 512 532 152 156 510 512 330 Each safety function chain,(A and B) is responsible for outputting independent signals to prevent computer-controlled braking efforts. Additionally, each chain,respectively outputs the Computer Inhibit OK status signal,to indicate that the chain is operating in the Manual Control mode. When in the Manual Control mode, the A chainoutput releases the service brakes () by setting the proportional control valve to zero pressure and returning parking brake control to the in-cab plunger valve. The B chainoutput locks out service brake control () using (e.g.) poppet valves within the assembly. Since parking brake control is returned to the in-cab plunger, further actuation is not possible by computer control. If both chains,(A and B) are not operating properly, the control is not returned to the driver, and the module enters the Emergency Stop mode.

(iii) Error Monitoring

510 512 550 520 522 Both the A chain logic blockand B chain logic blockperform error checking via a cross check. If an error is detected in one chain, then that chain of the safety function enters an error state. In the error state, Emergency Stop Braking is performed, and the Computer Inhibit OK signaloris removed/de-asserted. Each chain monitors the other chain for error status. If one chain detects that the other is in error, the detecting chain does not return control to the operator, ensuring that brakes cannot be released.

510 512 Each logic chain,(A and B) performs short circuit checking on the input Computer Control Request signals. Shorts are checked against ground, power, and between request signals using known techniques. The function does not enter the error state when a short circuit is detected. Additionally, the logic blocks compare their respective Computer Control Request signal states against each other. If there is a discrepancy in those states for more than 50 ms, then the safety function enters the error state.

510 512 Each logic chain,(A and B) performs short circuit detection on the output signals. Shorts are checked against ground, power, and between output signals. If a short is detected, the offending chain will enter the error state.

510 512 Each logic chain (A and B) monitors the effects of its output on returning brake control to the operator. Chain Amonitors the computer-controlled brake pressures to verify that the brakes are released. Chain Bmonitors pressure in the lock-out circuit sections. If either chain detects that its output is not having the desired effect, then it enters the error state.

210 320 The brake controller moduleis commanded under the Computer Control modeusing the J1939 CAN bus. Brake commands are expected to be received at a rate of at least 20 Hz in accordance with the communication protocol specified hereby. Module status is reported at approximately the same rate.

210 In a basic implementation, the brake controller module can accept the following types of commands; namely (a) Requested Service Brake Pressure or Percentage, (b) Requested Parking Brake State, and (c) Requested Trailer Supply State. In an alternate implementation, accepted brake controller module commands can also include (d) a Requested Acceleration command. This command causes the brake controller moduleto perform Service Brake Control to achieve the requested acceleration. Note that this behavior should account for the effects of regenerative braking in an electric vehicle.

Status messages for the J1939 implementation can include the following information, at a minimum; namely (a) Computer Controlled Service Brake Pressure, (b) Brake Pedal Controlled Service Brake Pressure, (c) Parking Brake Status, (d) Trailer Supply Status, (e) Internal Error Status, and (f) Operational Mode.

150 The brake controller module design consists of three primary sections, the Safety Interlock Module interface, the Service Brake Circuit, and the Parking Brake Circuit. These sections are implemented using a COTS SIL2 rated ECU and pneumatic components (valves, switches, and transducers). The brake controller EBCdetermines the proper operating mode based on the Safety Interlock Module interface. Based on the operating mode, the EBC uses electrical signals to control the state of various pneumatic valves in the Service Brake Circuit and Parking Brake Circuit. It also monitors pneumatic pressure switches and transducers to verify proper operation of those valves. Those valves and feedback signals are used to implement both computer control via a J1939 CAN interface and the Emergency Stop and Unintended Computer Control Safety Functions.

150 330 320 310 310 320 330 230 3 FIG. As described above, the brake controller EBCoperates in one of three modes or states, Emergency Stop, Computer Control, or Manual Control. The operational state is determined by the Safety Interlock Module interface signals and the presence of J1939 CAN commands, as shown in the above-described. Depending on the operational state,,, the Brake Controller EBC thereby set the Safety Interlock Modulestatus signals appropriately.

232 230 610 620 610 620 6 FIG. As also described above, the input signals (E-Stop Release 234 and Computer Control Request) from the Safety Interlock Moduleeach consist of two discrete digital lines A and B. Reference is made to the signal diagram of, which shows both the E-Stop Release timing diagramand the Computer Control Requested timing diagramfor the “ON” state of each. Each timing diagram shows the A and B chains passed 180-degrees with respect to the other. When a signal is off, both lines are set to OV. When a signal is on, the two digital lines take on complementary voltage values of either OV or 24V. As shown, the waveforms toggle at a frequency of 50 Hz, or every 20 ms. The “OFF” State is the opposite of that depicted for each signal,.

610 150 152 150 When the E-Stop Release signalis “ON,” the Brake Controller EBCreleases the E-Stop braking valves within the assembly. When the Computer Control Request signal is “ON,” the Brake Controller EBChonors brake commands arriving on the J1939 CAN bus.

150 The brake controller EBCmonitors the input signals for certain error conditions. The E-Stop Request and Computer Control Request digital pairs are generally monitored for short circuits, both with respect to a 24V specified peak, and with respect to each other. The following conditions will be monitored to determine if an error has occurred; namely (a) A and B signals are both at 24V for more than 5 ms (thereby indicates possible short between A and B), (b) A or B signal remains at 24V for more than 30 ms (thereby indicates short to 24V), and (c) only one of A or B signals is oscillating (thereby indicates open circuit or short to OV).

610 150 330 320 If an error is detected on the E-Stop Release input signal, then the brake controller EBCtransitions to the Emergency Stop mode. If an error is detected on the Computer Control Request input signal, then the brake controller EBC remains in the Computer Control mode, but applies full brakes and does not honor J1939 CAN commands.

150 320 If J1939 CAN commands are being received at a rate of at least 20 Hz, but the Computer Control Request signal is not “ON,” then the brake controller EBCtransitions to the Computer Control mode, and applies full brakes. All detected errors are reported via the J1939 CAN interface.

(iii) Service Brake Control

700 712 714 158 160 714 716 712 158 160 724 726 710 7 FIG. The Service Brake Control Circuit portionof the brake controller module is shown in more detail in. It provides two pneumatic pathwaysandfor applying service brakesand. These pathways include a proportional pathwaythat mimics the brake treadle valveand an on/off pathwaythat simply applies full braking effort. Both of these pathways are connected to the service brakes,via respective shuttle valvesand, along with the OEM brake pedal, as shown. The source which supplies the highest pressure to the circuit will be passed through the shuttle valves to the brakes. This enables the operator to always apply service brakes.

720 752 750 730 158 160 750 724 726 158 160 The Service E-Stop valveis a 3/2 poppet that is controlled by the SERV_ESTOP signal, issued by the output blockof the EBC brake controller's service brake subsystem/module. When the output signal is OV or disconnected, the valve passes air directly from the pressurized air tankto the service brakes,, applying full brakes. When the output signal is 12V, the valvechanges state and evacuates air between the valve and the shuttle valve,. If no other source is applying air, then the service brakes,are released.

740 754 750 754 720 740 The Service E-Stop Monitor pressure switchprovides a 12V signal, SRV ESTP MON to the associated input blockof the brake controller EBC () inputto indicate whether the Service E-Stop valveis applying brakes or not. When the valve applies full brakes, the pressure switchcloses and return the 12V signal to the input.

762 760 762 760 762 760 760 752 760 724 726 Service brake proportional control is provided via a combination 3/2 poppet valveand proportional control valve. The 3/2 poppet valve, also labeled Service Brake Enable, is used to enable or disable proportional brake control via the valve, also labeled Proportional Valve. The Service Brake Enable valveis controlled by the SERV_EN_CC output signal. When the output signal is OV or disconnected, the valve evacuates air between its output and the Proportional Valve, ensuring that the Proportional Valve cannot apply brakes. When the output signal is 24V, the valve supplies tank pressure to the Proportional Valve. The Proportional Valveis then controlled from the SERV_PROP 0-10V signal issued from the EBC output block, which is set by J1939 CAN commands. The Proportional Valveregulates air pressure to the brakes via the shuttle valves,, etc.

768 752 158 160 714 766 754 The Service Release Monitor pressure switchprovides a 12V signal to the SRV_REL_MON input () to indicate whether the proportional pathway has released the brakes,. When the proportional control pathreleases the brakes, this switch will close and return 12V to the input. Additionally, the CC Service Pressure transducerprovides an analog signal to indicate the actual pressure being applied by the proportional control path. That signal is read at the SRV_CC_PRES input ().

716 754 770 The Pedal Service Pressure transducer also provides an analog signal to indicate the pressure being applied by the brake pedal treadle valve. That signal is read at the SRV_PED_PRES input () via an in-line transducer.

750 720 Under nominal computer control operations, the Brake Controller EBCreleases the Service E-Stop valveby setting the SRV_ESTOP output to 12V. It will then enable proportional control by setting the SRV_EN_CC output to 24V. Finally, it will set the SRV_PROP output signal based on the J1939 CAN commands to control actual braking pressure (EDOG-BRK-0005).

When operating under manual control, the SRV_PROP output signal should be set to 0 and the SRV_EN_CC signal should be turned off. This will inhibit computer control via the proportional pathway.

8 8 FIGS.A-C 800 850 850 800 810 812 814 816 814 816 Reference is made to, collectively showing a parking and trailer supply control arrangementand associated pressure circuit (which routes and switches pressurized gas/air through various pipes, tubes and/or hoses of appropriate size and pressure-rating), employing the parking brake circuit subsystem/moduleof the overall brake controller EBC. This subsystem/moduleand associated arrangementenables computer control of the vehicle/truck parking brakesand trailer air supply (e.g. glad hand). When operating under computer control, the respective in-cab, manually actuated, plungersandfor parking brakes and trailer air supply are locked out to prevent misapplication. When control is returned to the operator, those plungers,become operational again. Note that this could lead to unexpected behavior. For example, if an operator applies the parking brake and relinquishes control to the autonomy system, the autonomy system could release the parking brake. If the operator subsequently takes manual control without releasing the parking brake plunger, the parking brakes will be applied upon operator intervention.

824 826 810 852 824 826 830 832 810 812 The Auto/Manual Selection valvesandare 3/2 poppets which select between computer control and plunger control for the parking brakes. When the PARK_LOCKOUT signal issued from the brake controller EBS outputis set to OV, or disconnected, these poppet valves,select computer control by routing air from the Tractor Parking Brake valveand the Trailer Brake Supply valve. When the output is set to 12V, the poppet valves route air from the in-cab plungers, thereby giving the operator control of the parking and trailer brakes,.

824 826 830 810 852 832 When the Auto/Manual Selection valves,are configured for computer control, the Tractor Parking Brake 3/2 poppet valveis used to apply and release the tractor parking brakes. When the TRAC_PARK_REL signal is set to OV or disconnected by the output block, the valve evacuates air from its output to the Auto/Manual Selection valve. If that valve is configured for computer control, air is also evacuated from the parking brakes, thereby applying brakes. If the output is set to 12V, air is supplied to the parking brakes to release them. Air is also supplied to the Trailer Brake Supply valve.

832 816 852 832 812 830 812 832 830 812 The Trailer Brake Supply 3/2 poppet valveis used to supply or remove air from the trailer lines, similar to the in-cab plunger. When the TRAL_PARK_REL signal at the output blockis set to OV, or disconnected, the valveevacuates air from the trailer supply lines and applies the trailer brakes—if a trailer is connected. When the output is set to 12V, the valve routes air from the Tractor Parking Brake valveto the trailer supply lines, which will release the trailer brakes, if a trailer is connected. Note that if the Trailer Brake Supply valveis supplying air to the trailer brakes, and the Tractor Parking Brake valveis turned off to apply parking brakes, the trailer brakes will be applied as well since the Tractor Parking Brake valve supplies air for the trailer.

841 854 850 830 810 840 854 832 840 830 The CC Tractor Parking Monitor pressure switchprovides a 12V signal to the CCTRC_PK_MON in the input blockof the brake Controller EBCinput when the Tractor Parking Brake valveis turned off, and applies the brakes. Similarly, the CC Trailer Supply Monitor pressure switchprovides a 12V signal to the CCTRL_PK_MON input () when the Trailer Brake Supply valveturns off, and applies trailer brakes. Note that there is some ambiguity in this case, however, since this pressure switchis also be triggered simply by turning off the Tractor Parking Brake valve.

844 854 814 810 848 The Plunger Tractor Parking Monitor pressure switchprovides a 12V signal to the PLTRC_PK_MON input () when the in-cab parking brake plungeris pulled out to apply parking brakes. Similarly, the Plunger Trailer Supply Monitor pressure switchprovides a 12V signal to the PLTRL_PK_MON input when the in-v cab trailer supply plunger is pulled out to apply trailer brakes.

860 862 810 854 812 854 Additionally, the Tractor Parking Monitor and Trailer Supply (Parking) Monitor pressure switches,and, respectively, monitor the overall parking brake and trailer supply status. If the parking brakesare applied, 12V is supplied to the TRC_PK_MON input (). If the trailer air supplyis removed (thereby applying trailer brakes), 12V will be supplied to the TRL_PK_MON input ().

850 852 814 816 810 852 810 850 812 Under nominal computer control, the brake controller EBCsets the PARK_LOCKOUT output () to OV to lockout the in-cab plungers,, and to enable computer control. If the EBC receives a J1939 command to release the parking brakes, it will set the TRAC_PARK_REL output () to 12V. To apply parking brakes, it will set the same output to OV. If the EBCreceives a J1939 command to connect the trailer air supply, then it will set the TRAL_PARK_REL output to 12V. This action directs the service brake pressure and parking brake pressure to the trailer. To disconnect trailer air, it will set the same signal to OV.

850 852 814 816 When operating under manual control, the EBCsets the PARK_LOCKOUT output () to 12V to enable control via the in-cab plungers,, and inhibit computer control.

870 730 854 850 Note that the circuit further includes a tank monitor pressure switchthat monitors pressure of the vehicle supply tank, and transmits a signal TANK MON to the input blockof the EBC. If tank pressure falls below a predetermined threshold, the brakes are applied, and signals issued by other monitor switches can be considered invalid. This provides a safety feature in the event of loss of pressure to the system.

It should be clear that the above-described system and method provides a robust and effective control arrangement for providing failsafe operation to an autonomous truck and associated trailer in the presence of required human intervention. The system and method ensures that the operating environment remains free of contradictory commands between the human and computer operators and affords deference to the human operator's commands and judgment. The system and method can be integrated with existing vehicle pneumatic, communications and electrical systems, and allows existing and future safety requirements in association with autonomous vehicles to be addressed.

The foregoing has been a detailed description of illustrative embodiments of the invention. Various modifications and additions can be made without departing from the spirit and scope of this invention. Features of each of the various embodiments described above may be combined with features of other described embodiments as appropriate in order to provide a multiplicity of feature combinations in associated new embodiments. Furthermore, while the foregoing describes a number of separate embodiments of the apparatus and method of the present invention, what has been described herein is merely illustrative of the application of the principles of the present invention. For example, as used herein, various directional and orientational terms (and grammatical variations thereof) such as “vertical”, “horizontal”, “up”, “down”, “bottom”, “top”, “side”, “front”, “rear”, “left”, “right”, “forward”, “rearward”, and the like, are used only as relative conventions and not as absolute orientations with respect to a fixed coordinate system, such as the acting direction of gravity. Moreover, a depicted process or processor can be combined with other processes and/or processors or divided into various sub-processes or processors. Such sub-processes and/or sub-processors can be variously combined according to embodiments herein. Likewise, it is expressly contemplated that any function, process and/or processor herein can be implemented using electronic hardware, software consisting of a non-transitory computer-readable medium of program instructions, or a combination of hardware and software. Also, qualifying terms such as “substantially” and “approximately” are contemplated to allow for a reasonable variation from a stated measurement or value can be employed in a manner that the element remains functional as contemplated herein—for example, 1-5 percent variation. Accordingly, this description is meant to be taken only by way of example, and not to otherwise limit the scope of this invention.